Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting

2026-09-04

AI Summary

本文探讨了利用HTTP/2特性来对抗网页指纹识别攻击，通过客户端和服务端的多种防御方法，并评估了这些方法的有效性和隐私开销。

Abstract

Website fingerprinting (WF) attacks can infer which webpage a user visits from encrypted HTTPS traffic alone, compromising privacy even without decryption. WF defenses commonly shape traffic through noise, padding, delays, or flow splitting, yet they are most often studied from the perspective of encapsulating protocols like Tor or VPN rather than at the application layer (HTTP). In this work, we focus on application-layer defenses enabled by the most widely deployed version of HTTP, HTTP/2. We demonstrate how known defenses can be emulated through HTTP/2 features at the client side (HTTPOS, LLaMA, FRONT, Tamaraw) and the server side (ALPaCA, Tamaraw). We further show that HTTP/2 features, such as proactive resource suggestion, multiplexing, and flow control, offer untapped potential for lightweight yet effective defenses deployable at both endpoints. We evaluate these defenses using a unified blueprint that calibrates defense parameters per dataset, then combines practical attacks, information-theoretic leakage estimates, and overhead measurements. For each defense, this framework identifies the strongest hyperparameter-tuned fingerprinting model and estimates the residual uncertainty induced by the defense using two information-theoretic leakage estimators, all while accounting for the defense's privacy-overhead trade-offs.

Problem

• Website Fingerprinting
• Privacy-Preserving
• HTTP/2
• Encrypted Traffic
• Application Layer

Innovation

• HTTP/2
• webpage fingerprinting
• application-layer defense
• multiplexing
• flow control